RE: [PATCH 1/1] gdb: Fix segfault with a negative .dynamic section size

["Willgerodt, Felix" <felix.willgerodt@intel.com>]

> -----Original Message-----
> From: Tom Tromey <tom@tromey.com>
> Sent: Dienstag, 14. November 2023 17:30
> To: Willgerodt, Felix <felix.willgerodt@intel.com>
> Cc: Tom Tromey <tom@tromey.com>; Keith Seitz <keiths@redhat.com>; gdb-
> patches@sourceware.org
> Subject: Re: [PATCH 1/1] gdb: Fix segfault with a negative .dynamic section size
> 
> >>>>> Willgerodt, Felix <felix.willgerodt@intel.com> writes:
> 
> > BFD is checking the section size against the file size two times and once
> > It checks if the section size is staying in the ELF segments region.
> > I don't think another warning from GDB would help.  Or what GDB at this
> > part of the code could do differently if it encounters such a thing.
> 
> Ok, I understand the problem now, I think.
> 
> bfd_get_section_contents does the size check -- but the buffer for the
> contents must be allocated before this call.  So, this approach is
> forced on us by BFD's API.
> 
> Maybe changing that would be good, but meh, (1) changing BFD can be
> difficult, and (2) it seems like a lot of work for fuzzer input.
> 
> I do wonder now why gdb generally uses bfd_get_section_contents and not
> bfd_get_full_section_contents, as the latter supports decompression while
> former does not.

I am afraid I am not familiar enough with section compression to answer that.
Though I would see it as a separate bug if we don't decompress it but should.
Granted, then we could think about using something like
bfd_malloc_and_get_section and a free().

Felix
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de <http://www.intel.de>
Managing Directors: Christin Eisenschmid, Sharon Heck, Tiffany Doon Silva  
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928